Why would the default deny rule block this connection?

[cyberspirit]

I having trouble with the default deny rule (ipv4) for just one machine.
Why would this one be blocked?

Please see attachment

Any ideas?


[johnpoz]

Because its out of state - notice the A..  that is ACK.. if pfsense never saw the SYN then no state would be open.

https://doc.pfsense.org/index.php/Why_do_my_logs_show_%22blocked%22_for_traffic_from_a_legitimate_connection

[kpa]

Do yourself a favor and turn off logging for the default deny rule, the option is at Status/System Logs/Settings/Log firewall default blocks. The reason you don't want to keep this option enabled is that it logs awfully lot of useless stuff from improperly torn down connections and other internet noise. Write your own specific rules to log traffic you want to log instead.